Mercurial > libervia-web
view themes/default/images/atom/Feed-icon.svg @ 956:dabecab10faa
server (pages): impleted CSRF protection:
A basic CSRF protection has been implemented using CSRF token. The token is created on session creation, and checked on data post.
The process should be fully automatic, and a hidden field is added in forms in sat_templates when csrf_token is present in template data (require to import input/form.html with context).
If token is wrong on absent, an unauthorized error page is returned (and client ip is logged).
Also don't use anymore inlineCallbacks in _on_data_post, as StopIteration exception are catched by inlineCallbacks, resulting in bad behaviour. As a further security, getPostedDate raise a KeyError instead of StopIteration is a specific key is looked for and missing.
Added HTTP_SEE_OTHER status code in constants.
author | Goffi <goffi@goffi.org> |
---|---|
date | Mon, 10 Jul 2017 19:10:31 +0200 |
parents | 3eb26b269539 |
children |
line wrap: on
line source
<?xml version="1.0"?> <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"> <svg xmlns="http://www.w3.org/2000/svg" version="1.1" width="128px" height="128px" id="RSSicon" viewBox="0 0 256 256"> <defs> <linearGradient x1="0.085" y1="0.085" x2="0.915" y2="0.915" id="RSSg"> <stop offset="0.0" stop-color="#E3702D"/><stop offset="0.1071" stop-color="#EA7D31"/> <stop offset="0.3503" stop-color="#F69537"/><stop offset="0.5" stop-color="#FB9E3A"/> <stop offset="0.7016" stop-color="#EA7C31"/><stop offset="0.8866" stop-color="#DE642B"/> <stop offset="1.0" stop-color="#D95B29"/> </linearGradient> </defs> <rect width="256" height="256" rx="55" ry="55" x="0" y="0" fill="#CC5D15"/> <rect width="246" height="246" rx="50" ry="50" x="5" y="5" fill="#F49C52"/> <rect width="236" height="236" rx="47" ry="47" x="10" y="10" fill="url(#RSSg)"/> <circle cx="68" cy="189" r="24" fill="#FFF"/> <path d="M160 213h-34a82 82 0 0 0 -82 -82v-34a116 116 0 0 1 116 116z" fill="#FFF"/> <path d="M184 213A140 140 0 0 0 44 73 V 38a175 175 0 0 1 175 175z" fill="#FFF"/> </svg>